Federated Access Control Across Multi-Tenant Cloud Components
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant cloud-based networks like BNAC, the separation of components in separate cloud tenants hampers the enforcement of complex data access rules that rely on organizational and user-object associations, leading to inconsistent data access control across various components.
Innovation Solution
Implementing a federated access control system that defines data access rules based on organizational and user associations, generates structured notifications of rule modifications, transmits these via a notification interface to a shared access control layer, and enforces these rules across extended components in real-time or near real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If components are separated into discrete cloud tenants to enable independent deployment and scalability, then system adaptability and deployment flexibility are improved, but access control consistency and data security are worsened due to inability to enforce complex access rules across tenant boundaries
Solution Approach 1:
The patent introduces a message bus as an intermediary component that enables communication between discrete cloud tenant components. The message bus transmits access control rule changes and events across tenant boundaries, allowing the system to maintain component separation for deployment flexibility while ensuring access control consistency through centralized message distribution to all relevant components.
2Reliability
If complex access control rules are implemented based on organizational and user associations, then data security is improved, but system complexity increases due to the need to track and enforce multiple association types
Solution Approach 1:
The patent segments the access control system into distinct modular components: rule definition modules, association tracking modules, message generation modules, and rule enforcement modules. Each component handles a specific aspect of access control, reducing overall system complexity by dividing the complex functionality into manageable, independently maintainable units while still enforcing comprehensive security rules.
Solution Approach 2:
The system implements feedback mechanisms where access control rule changes trigger automated message generation and distribution to relevant components. This feedback loop ensures that security rules are consistently enforced across the system without requiring manual configuration updates, reducing the operational complexity of managing complex access control policies.
3Reliability
If real-time access control rule updates are implemented across all components, then access control consistency is improved, but communication overhead and processing time increase
Solution Approach 1:
The patent implements periodic action through event-driven updates rather than continuous synchronization. Access control rules are updated and propagated across components only when changes occur, triggered by specific events such as rule modifications or association changes. This approach maintains access control consistency while minimizing communication overhead by avoiding unnecessary periodic synchronization.
Data Source
AI summary
Provided herein is a method, wherein the method includes defining, based on at least one of an organization's association with an object and a user's association with the object, a data access rule; generating a notification in response to a modification to the data access rule, wherein the notification comprises one or more structured messages indicative of the modification to data access rule; transmitting, via a notification interface, the one or more structured messages to a shared access control layer to update the data access rule; federating the updated data access rule to one or more extended components; and enforcing the updated data access rule to control access to the object based on the updated data access rule.